���A(��FԎ�h�������=s4���_�}GLXZ9"�`��68P~g?��HO�&뚱ZҊL�2�V:z�����/T1��%���nD.�S����ߜ���x�����fE��w�����+�+��.�h����<�����/ `��X��a��kt��K�=�۞?�C��I�}�59y��*�'��?de"H0�lW�)�:ٍ"���w�x`>95F�_4�Bh�����$���T�����c�'V�>�*�i�M����^�D�'�KD�u,����l3�V0�ybo�|�?��Wym� 2��:�GŏS�n20����I�* 6��b���p.��xA�n�$��Cq�V�ʹM�Vu'���2�8jD) ������Uw����K����K�vp:�l(��ZU��*�{�ҟ�S*\��|����殘_`yS��9��x�4 r�EEL���f.��"HS7B�l)�$wJl�� �yD�4�!�%�m&ki����6<��5W��g�p}��@�1?����"�y�V�������G���>Y]eaQ.E"��<�9ܢl�e*�qT;7,�����i�_�*Cal}Չi��;��z���jjN�n�d7�#�%L�UY�Q����V.��gBv�Y��Pm��uIJ�V:�\+����p��f�&�LAMX&;��E�n4��Y�2����z}a� ���E�!�k:�MM@O�dc~���R��p�b�(jFQΣ>^�H"�]��!(��!���1.��[�A��� V���껫������6O������>� ��hj(��&6����(l��J��ro7��K0E�U~�x"z �tJ�����}�ME`����#��:@���{��`���E��|S-<]�(�������ʠ��#0I�I,����?W���u?*��V�sG}��v?�x�̳^P>o��(S�������r`zr.��ՠ>����������'���x�0~��Q;�fdќm��@�=����I��ϧ��ֲۙ���b��v;c n݂�<1?��M����<JI�%�T���b��I�y�Xp�`SL)���-o4'�"J*Q���EH�F�)m�9��n<��}����/�\�߿3��i���t�[�e�1�|mJ�;��P:0~]�d��C��a��H+%��Xz��fI ���+}T��(W,qSn���l��NB����Q6]#3�'ˌ)>��𩻖Cv�-6idg$w�d��03¥��w�AP҃(E�U���x���'��,�7��R4ab��X��?��7�B���w�Q�-�|ѧ� g�"s(��|�DJ�-Aa�����=E��\u'7�0q�?�|~/.�.,l�IwM��~;��=�C�����{�B��5Gd���3� �a{zr�Fל�UC��,��ݾIdZ�!F�ߙ!S[;J�d@{;�S2sN���L���b��P���y���gx�w�8sQ���<J���M���s����P� �b^ψ�[P���2�Ǥ@ö+܁e}u�~�w�|�9����D_�.��bP���`G xe#c ���N��R�+�4���<�6�H�s�p������-�Ylѽ�.�C�N����G��*P$��xK=�o��<?$�c߇W�"N����̝�j�@8�#��u����_�GU)kz�ʕ�,m�L��{�Wd{'�RV'��q2}Q]�r�%�yp �8�+��������e��S-a���r��ǪnD��K�`�Y"��nןN7B��8L�8����F ��"1��L�p��t�|�[_m� #����F6YS�f�g�75�u��ڛ�����ċxp�¿�������95K���T��D��Cψ�x���)�z.���� �f%���<��ׯ�M����F{��kN���n��=q�H��-ƇN��f��&%��L��c���֔���Zu� =�9 �I��Ӌ�8�@ў���5�� |�/������c�m����Kt�N���L��OJ�D���X��& Y�t엫�� �t0v��v��ӳ ���&9�گ�$��ę��g4�"��{!��-�p3�%8�7`N�,����������Xw��H���P�������w:5�����~���\l����%���tD�Cb6ꬺ�;��Q�Q�r����2�F`)���q��4���3�~�s;��|�- 7�v�Umsk�)4,_� 1��vi�<���^�yқ����n6B�p��?�F܋����SIУG���S�dBo�P�X�(a+�cC'x72sZ�� �o�C�.|�Gι��x��q`U�ڪ�)$o�U�ȷ��EئAW�l!��J�sE�`���T��9V)}�O"�>H2}r�<C��[ ���.�A;��CW�=�����K�Ҝi�ž�a��e�!R��s6D�#u���_��\51�#7쎊@��d]� ����6����p�5�k��Rj]�A�9���*�H�` �P����#'� ݏz��<��ۅ��,�!�N�mw ���� �lO�,�� q�~�w���`��`T���aM3��y����vڜ��Ys'~�*�����Tȣ�y`�q�s��v���XM5���)���6���j̟������e�!�ʂ|G�V������a�Bx�~�� oW����������%�:�O�o��C��8F*��`v�UV�<}-<S��j�1��f���8�,�H������bi|�U��M����������d�*hK�y/*@ '�R�z�g�T�&E<Dr��5��������𦇅z _�B� 2h<�Hݤ��<v㢅����������V]=_V���p�J��H7 � q�V��b���Z^�'CSDiF�%��z�0G�zJU.=��q�`,T��Fk������_��˒�b����Y�?IKn���K�s�'=Ö{.&�N���*y�E���DH��!�����1��?�6�rw���)�4]q������ζ0r�1��ѻ��(����ze��2�gC��Wsԕ+0 8�Dqک�����`��cF���n۽3�sq6pb/B(�o�[II��P���wf�W��) t�sTSHϒc����E9�$���kG�(�bF>��}�rT��ο��
Static task
static1
Behavioral task
behavioral1
Sample
7d3c339e84da6c7c7ebe306fa632d2233ce06fafed4cdc5be9f6850a1c3dc653.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7d3c339e84da6c7c7ebe306fa632d2233ce06fafed4cdc5be9f6850a1c3dc653.exe
Resource
win10v2004-20240508-en
General
-
Target
7d3c339e84da6c7c7ebe306fa632d2233ce06fafed4cdc5be9f6850a1c3dc653
-
Size
7.1MB
-
MD5
7cdd57e630910e9f05a5cbe2f1ae34af
-
SHA1
b000d832cf9d456f4844c16b8989409153795819
-
SHA256
7d3c339e84da6c7c7ebe306fa632d2233ce06fafed4cdc5be9f6850a1c3dc653
-
SHA512
94c2a683e9b4039f72df057e4af4a9d974fed5d4e7592d70637071859cb15a6f4bca118835bec43719c5c7746628a886246916e22d843568499e00abfc97d184
-
SSDEEP
98304:xrKHEZLIKWjLjdhfSQcYY/1w8Gf6/fO9BrdONh4QUH4zqEChRtsXut9wq7o2stZN:pKHmNSLjHfhGpObYTNUHRATq0j6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7d3c339e84da6c7c7ebe306fa632d2233ce06fafed4cdc5be9f6850a1c3dc653
Files
-
7d3c339e84da6c7c7ebe306fa632d2233ce06fafed4cdc5be9f6850a1c3dc653.exe windows:5 windows x86 arch:x86
ec8fa65ebb25fed2432005a5a716b8dd
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamOut
ws2_32
WSACleanup
kernel32
GetVersion
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindow
CharUpperBuffW
gdi32
TextOutA
winspool.drv
OpenPrinterA
advapi32
RegQueryValueExA
shell32
Shell_NotifyIconA
ole32
CLSIDFromProgID
oleaut32
UnRegisterTypeLi
comctl32
ord17
wininet
InternetCloseHandle
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 662KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 141KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 297KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.9#Y Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.D%2 Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.~G] Size: 7.0MB - Virtual size: 7.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 60KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ